Is it possible to give users access to a virtualised instance of Excel - I don't want to give them access to a full OS (although this will clearly be running in the background, all they can access is Excel - they don't even see any other screens)?

Secondly, if it is possible, is it possible to do within a browser?

Edit

I am building a system which is designed to test candidates skills in Excel and for this reason needs to use the full desktop version and not a web app. I don't want to have to ensure Excel is installed on the client machine as there will be issues around differing versions and security as the workbook(s) that are used in the test use VBA extensively to customise and mark the exercises. Ideally my web app would be able to open a session to the server which then just puts the user into an instance of Excel without ever seeing a desktop. I would also need to be able to pass in command line parameters in order to define which workbook to open and also pass in a unique token to identify the user

Your best bet is an RDP session that directly opens Excel. (You could go with a VDI solution, but unless you already have that infrastructure set up, it's probably more than you want to get into...) As far as a Remote Desktop Solution In their AD User account, go to the Environment tab, and set the application and options. When they log in, (in this example), Excel should open with the file spreadsheet.xls (which is stored in H:\Users\Desktop). If the user closes Excel, they are logged out.

Please note that I'm roughing the settings; I know that the config looks something like this, but the details may be off.

However, because you stated that you need to test the full capabilities of a candidate your best bet is to take a look at RemoteApp or an actual Remote Desktop Session. RemoteApp does require a remote desktop session and profile, the difference is that the desktop is hidden and abstracted for the user. Regardless, if you are going to be testing them on VBA Remote Desktop is probably the way to go so that you can encapsulate users in their own session that won't hurt the server if they run some bad VBA or Macro code.